Alex (Alejandro Campos Magencio)

Alex (Alejandro Campos Magencio)

The certificates in the Server Certificates section of IIS Manager (inetmgr.exe) are certificates located in MY certificate store of the local machine, and their Enhanced Key Usage is Server Authentication. The following sample gets those certs:

# Get all certs in MY store of Local Machine profile
 $store = New-Object System.Security.Cryptography.X509Certificates.X509Store("My","LocalMachine")
 $store.Open("ReadOnly")
 $store.Certificates | 
 % { 
 # Get all extensions for one cert
 $cert = $_
 $cert.Extensions | 
 % { 
 # Find "Enhanced Key Usage" extension
 $extension = $_
 If ($extension.Oid.FriendlyName -eq "Enhanced Key Usage")
 {
 # Get all enhanced key usages for the cert
 $enhancedKeyUsageExtension = [System.Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension]$extension
 $enhancedKeyUsageExtension.EnhancedKeyUsages | 
 % { 
 # Find "Server Authentication" enhanced key usage
 $enhancedKeyUsage = $_
 If ($enhancedKeyUsage.FriendlyName -eq "Server Authentication") 
 {
 # We found a cert that will get listed in Server Certificates list in IIS Manager. Show its info 
 $cert | Select Subject, Issuer, NotBefore, NotAfter, Thumbprint, SerialNumber
 } 
 }
 } 
 }
 }
 $store.Close()

I hope this helps.

Regards,

Alex (Alejandro Campos Magencio)

The other day a customer of mine was creating a SSL certificate request with IIS Manager (inetmgr.exe) with "Create Certificate Request..." action in the Server Certificates section. He was sending that request to a Certificate Authority, and he wanted to programmatically install the .cer file with the response from the CA the same way you do it manually with "Complete Certificate Request…" action in the Server Certificates section.

The following Powershell sample does that:

$strBase64Response = get-content "C:\Test\Base64.cer"
 $objEnroll = New-Object -ComObject X509Enrollment.CX509enrollment
 $objEnroll.Initialize(0x2);
 $objEnroll.InstallResponse(0x4, $strBase64Response, 0, $null)

Note: the 0x2 value in Initialize call means ContextMachine, and the 0x4 value in InstallResponse call means AllowUntrustedRoot.

Note: you need to run this with an administrator, as the cert will go to the MY certificate store of the local machine, and only admin users have access to write in there by default.

I hope this helps.

Regards,

Alex (Alejandro Campos Magencio)

The following sample is a conversion of How to export issued certificates from a CA programatically (C#) sample to PowerShell. It will get all the issued certs in the CA database and copy them to a folder:

#Params 
 $strServer = "myserver"; 
 $strCAName = "myserver-CA"; 
 $strPathForCerts = "c:\test\"; 
 
 # Constants 
 $CV_OUT_BASE64HEADER = 0; 
 $CV_OUT_BINARY = 2; 
 
 # Connecting to the Certificate Authority 
 $objCertView = New-Object -ComObject CertificateAuthority.View
 $objCertView.OpenConnection($strServer + "\" + $strCAName)
 
 # Get a column count and place columns into the view 
 $iColumnCount = $objCertView.GetColumnCount(0)
 $objCertView.SetResultColumnCount($iColumnCount)
 
 # Place each column in the view
 for ($x=0; $x -lt $iColumnCount; $x++)
 {
 $objCertView.SetResultColumn($x)
 } 
 
 # Open the View and reset the row position 
 $objCertViewRow = $objCertView.OpenView(); 
 $objCertViewRow.Reset(); 
 
 # Enumerate Row and Column Information 
 # Rows (one per cert) 
 for ($x = 0; $objCertViewRow.Next() -ne -1; $x++) 
 { 
 # Columns with the info we need 
 $objCertViewColumn = $objCertViewRow.EnumCertViewColumn() 
 while ($objCertViewColumn.Next() -ne -1) 
 { 
 switch ($objCertViewColumn.GetDisplayName()) 
 { 
 "Request ID"
 {
 #Request ID 
 $objValue = $objCertViewColumn.GetValue($CV_OUT_BINARY)
 if ($objValue -ne $null) { 
 $strID = "Request ID " + $objValue
 }
 break
 } 
 
 "Binary Certificate"
 {
 # Binary Certificate 
 $objValue = $objCertViewColumn.GetValue($CV_OUT_BASE64HEADER); 
 if ($objValue -ne $null) { 
 # Write certificate to file 
 $strPath = $strPathForCerts + $strID + ".cer"
 Set-Content $strPath $objValue
 } 
 break
 }
 default 
 {
 }
 } 
 } 
 } 
 
 Write-Host "We are done!`nCerts have been copied to " + $strPathForCerts

I hope it helps.

Regards,

Alex (Alejandro Campos Magencio)

The following sample is a simplification of How to get info from client certificates issued by a CA (C#), and gets all the issued certs in the CA database and copies them to a folder:

using System;
 using System.Windows.Forms;
 using System.IO;
 using CERTADMINLib;
 
 …
 
 // Parameters
 string strServer = "myserver";
 string strCAName = "myserver-CA";
 string strPathForCerts = "c:\\test\\";
 
 // Constants
 const int CV_OUT_BASE64HEADER = 0;
 const int CV_OUT_BINARY = 2;
 
 // Variables
 CERTADMINLib.CCertView certView = null;
 CERTADMINLib.IEnumCERTVIEWROW certViewRow = null;
 CERTADMINLib.IEnumCERTVIEWCOLUMN certViewColumn = null;
 int iColumnCount = 0;
 object objValue = null;
 string strID = "";
 StreamWriter objFile = null;
 
 // Connecting to the Certificate Authority
 certView = new CERTADMINLib.CCertView();
 certView.OpenConnection(strServer + "\\" + strCAName);
 
 // Get a column count and place columns into the view
 iColumnCount = certView.GetColumnCount(0);
 certView.SetResultColumnCount(iColumnCount);
 
 // Place each column in the view.
 for (int x = 0; x < iColumnCount; x++)
 {
 certView.SetResultColumn(x);
 }
 
 // Open the View and reset the row position
 certViewRow = certView.OpenView();
 certViewRow.Reset();
 
 // Enumerate Row and Column Information
 
 // Rows (one per cert) 
 for (int x = 0; certViewRow.Next() != -1; x++)
 {
 // Columns with the info we need
 certViewColumn = certViewRow.EnumCertViewColumn();
 while (certViewColumn.Next() != -1)
 {
 switch (certViewColumn.GetDisplayName())
 {
 // Request ID
 case "Request ID":
 objValue = certViewColumn.GetValue(CV_OUT_BINARY);
 if (objValue != null)
 {
 strID = "Request ID " + objValue.ToString();
 }
 break;
 
 // Binary Certificate
 case "Binary Certificate":
 objValue = certViewColumn.GetValue(CV_OUT_BASE64HEADER);
 if (objValue != null)
 {
 // Write certificate to file
 objFile = File.CreateText(strPathForCerts + strID + ".cer");
 objFile.Write(objValue.ToString());
 objFile.Close(); 
 }
 break;
 
 default:
 break;
 }
 }
 }
 
 MessageBox.Show("We are done!\nCerts have been copied to " + strPathForCerts);

I hope this helps.

Regards,

Alex (Alejandro Campos Magencio)

Alex (Alejandro Campos Magencio)

Alex (Alejandro Campos Magencio)

Alex (Alejandro Campos Magencio)